It's not a minimum.
Nothing in the GDPR states this. It's obviously the intent, but ultimately it's left up to the bon vouloir of EU regulators.
It is perfectly legal under the GDPR to make an example out of you by levying the maximum fine for a first offense, and without warning.
No it isn't. Read Article 83.
[0] https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889
You'd have to be a consistant repeat offender, with no effort made at remediation, with no cooperation with the regulator, and probably handling sensitive or financial data.
Here's a list of recent actions taken. I think the current maximum fine is £500,000. Have a look through a few of these hopefully it's somewhat reassuring.
When I read things like this I realize how many companies are not treating user data as they should. Protecting user data should already be built into the company software and process.
Given FB revelations and additional scrutiny to Google, I see some form of this law coming to the US.
>Given FB revelations and additional scrutiny to Google, I see some form of this law coming to the US.
That would be good news for the EU, of course. Even before GDPR, entrepreneurs were routinely advised to incorporate in US instead, and the legislation likely added incentives for that.
But, dispite this widespread non-compliance and fierce fines available to the regulators the sky hasn't fallen. Why do people think GDPR is sudden;y going to make things so much worse?
